netdev - Re: [PATCH net ver.2] genetlink: fix possible use-after-free and null-ptr-deref in genl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZdSAndRQxKGkV/EO@calendula>
Date: Tue, 20 Feb 2024 11:36:13 +0100
From: Pablo Neira Ayuso <pablo@...filter.org>
To: kovalev@...linux.org
Cc: netdev@...r.kernel.org, pabeni@...hat.com, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, jiri@...nulli.us,
	jacob.e.keller@...el.com, johannes@...solutions.net,
	idosch@...dia.com, horms@...nel.org, david.lebrun@...ouvain.be
Subject: Re: [PATCH net ver.2] genetlink: fix possible use-after-free and
 null-ptr-deref in genl_dumpit()

On Tue, Feb 20, 2024 at 01:25:12PM +0300, kovalev@...linux.org wrote:
> From: Vasiliy Kovalev <kovalev@...linux.org>
> 
> The pernet operations structure for the subsystem must be registered
> before registering the generic netlink family.

IIRC, you pointed to a syzbot report on genetlink similar to gtp.

Maybe add that tag here and get the robot to test this fix?

I'd suggest to describe the scenario, which is: There is a race that
allows netlink dump and walking on pernet data while such pernet data
is not yet set up.

Thanks.

> Introduced in commit 134e63756d5f ("genetlink: make netns aware")
> Signed-off-by: Vasiliy Kovalev <kovalev@...linux.org>
> ---
>  net/netlink/genetlink.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
> index 8c7af02f845400..20a7d792dd52ec 100644
> --- a/net/netlink/genetlink.c
> +++ b/net/netlink/genetlink.c
> @@ -1879,14 +1879,14 @@ static int __init genl_init(void)
>  {
>  	int err;
>  
> -	err = genl_register_family(&genl_ctrl);
> -	if (err < 0)
> -		goto problem;
> -
>  	err = register_pernet_subsys(&genl_pernet_ops);
>  	if (err)
>  		goto problem;
>  
> +	err = genl_register_family(&genl_ctrl);
> +	if (err < 0)
> +		goto problem;
> +
>  	return 0;
>  
>  problem:
> -- 
> 2.33.8
>